What’s new in DomainWarn

Glossary

Around 40 terms from domain, email and website security have their own page at domainwarn.com/glossary: what the term means, how it works, why a mistake is dangerous, how to avoid it and which DomainWarn check finds it – with matching tools, guides and documentation pages. The A–Z overview is searchable.

Terms in findings

Technical terms in findings and incidents in the dashboard are underlined: hover over one for a short explanation, click it to open the glossary page in your language. Below, all terms for the finding are listed in one line.

Email security quick check based on BSI TR-03108 / TR-03182

A new free tool checks a domain with criteria based on the BSI technical guidelines for secure email transport and email authentication: STARTTLS and TLS on the mail server, DNSSEC, DANE, TLS-RPT, SPF, DKIM and DMARC. For each criterion you see its identifier and level (MUST or SHOULD), whether it is met, partly met, not met or not checkable, with a reason and a recommendation; the summary at the top reads like “11 of 14 met”. An automated test from the outside, not a certification.

NIS2 quick check

A second new tool maps the points of a domain that can be checked from the outside to the measures under Art. 21(2) NIS2: encryption and HSTS of the website, DNSSEC and CAA, name servers, domain expiry, security.txt and the protection of email. What only continuous monitoring can evidence – availability over 30 days, open ports – shows as “only with monitoring” instead of being guessed. There is no certificate for NIS2; the check only covers the measures visible from the outside.

Seal & banner

Show on your website that your domains are monitored with DomainWarn: under Settings › Organization › Seal & banner you create a seal with your company name and the DomainWarn logo – as a small seal, banner, leaderboard or square, light or dark, in English or German, with a live preview, an HTML snippet and a download as SVG or PNG. You decide what the seal shows: company name on or off (optionally with a name of your own), number of monitored domains and check date. A click leads to a confirmation page with name, logo, “customer since” and the last check; if the seal is switched off or no longer in your plan, it shows “no longer valid”. From Freelancer.

Check report and “Email security checked” seal

You can now create a dated email security check report for every domain: a unique report number, the check date, the result “External email security check – 13 of 14 criteria met” and all criteria from BSI TR-03108 and TR-03182 with their result, as a PDF with QR code and as a verification page that shows the state at the time of the check. On top, there is the seal “Email security checked · Criteria based on BSI TR-03108” for your website: DomainWarn checks the chosen domain daily, and the seal is only valid as long as all counted criteria are met – otherwise it shows “no longer valid”. An automated check from outside, not a certification by the BSI. From Freelancer.

Seals for customer domains

As an agency you can issue a dedicated “Email security checked” seal for each of your customers’ domains for them to embed on their website – with the customer as holder, its own verification page and the same daily check. Customer logins can copy the code themselves. DomainWarn keeps check reports for 13 months.

Partner programme and marketing material

If you recommend DomainWarn, you can become a partner: partners are listed with logo, description and link on the new “Partners” page, their seal says “Partner of DomainWarn” with its own badge and is valid regardless of the plan. Listed are those whose website shows the seal – DomainWarn checks this daily. “Partner material” offers logos, ad banners in five formats, screenshots of the dashboard and copy in English and German, one by one or as a ZIP; the seal page in the dashboard links to it.

Incidents on the domain

Every domain has its own “Incidents” tab with all open and resolved incidents, filterable by status and severity, with cause, acknowledging and report. The number of open incidents sits on the tab, the overview names the most recently resolved one from the last 30 days when none is open, and the incidents page filters by domain.

Notifications in the dashboard

The bell at the top of the dashboard collects what concerns you: features unlocked in addition, accepted invitations, failed payments, a used-up SMS quota, channels switched off after errors and finished or failed domain imports. A click takes you to the place in question; everyone has their own entries and marks them as read one by one or all at once. “All notifications” lists every entry on a page of its own, unread ones only if you like.

Search across the whole dashboard

The search field at the top now finds not only domains but also clients, incidents, events, invoices and members – in the area you pick or everywhere, grouped by area. / or Ctrl+K (⌘K) opens it, arrow keys and Enter pick a result.

Free plan for new accounts

New accounts monitor one domain on the Free plan after the 14-day trial, with the same scope otherwise. If you signed up before, you keep three domains on Free for good – nothing changes for you. More domains come with a plan from €19 per month.

New plan line-up with grandfathering

Screenshots, the privacy check, accessibility and white-label – reports and client emails in your own design, “hide DomainWarn” – are now only available on the Agency Pro plan for new use. If you already used one of these features on your plan, you keep it for good (grandfathering). Billing › Plan now shows “Additionally unlocked for you” with everything you get beyond your plan, including the date and grandfathering. The trial includes everything from Agency Pro – features and limits, single sign-on too.

Screenshots without cookie banners

DomainWarn now accepts cookie banners before capturing and waits until images have loaded and animations have finished – the screenshot shows the page the way visitors see it. The “Screenshots” page shows the selected change large in the middle, with reference screenshots and history to the right, and a click opens an image in a dialog instead of a new tab.

Subdomain inventory per domain

You now switch the subdomain inventory on per domain under Settings › Monitoring; new domains start without it, so that leftovers on forgotten subdomains are not all reported at once.

Paused domains

A paused domain shows “Paused” next to its name, and “Resume” sits on the right with the other actions. While it is paused, DomainWarn does not check it on demand either.

Sortable tables

A click on the column header sorts domains, clients, expirations, timeline, delivery log, members, API tokens and connected apps, a second one reverses the order. The sorting stays in the link and when you go back, the CSV export of expirations follows it, and you order incidents by urgency, newest or oldest first. Names sort alphabetically, upper and lower case together, umlauts with their base letter. Via the API you sort with sort and direction.

Invoices on a page of their own

Settings › Billing › Invoices lists all invoices with number, period, net, tax, gross and status, sortable. A click opens the invoice as a PDF right in the browser.

Live indicator with a reason

After an interruption the dashboard reconnects right away and loads what has changed in the meantime. If there is no live connection, the “Live” dot names the reason, and while monitoring is paused it says that nothing is coming in.

The MTA-STS and BIMI addresses hosted by DomainWarn (mta-sts.your-domain.com, bimi.your-domain.com) now redirect requests over http:// to HTTPS and send HSTS. Until now they only returned “404 page not found”.

In the English dashboard and in the domain check on the English website, severities now appear in English; until now every finding said “Kritisch” or “Warnung”.

Buttons and highlights in brand blue are easier to read on the website and in the dashboard: the white text lacked contrast and now meets WCAG 2.2 AA, on hover too. The language switcher now also tells screen readers the language shown.

Accessibility checks

A new free tool and a daily monitor test pages for barriers against WCAG 2.2 AA, the basis of the European Accessibility Act. Missing alt text, weak contrast and unlabelled buttons show up with an example and guidance; new serious barriers are reported right away. Switch the monitor on per domain (from Freelancer).

Screenshots

DomainWarn captures your page every hour in a real browser and compares it with a reference screenshot. Defaced pages (“hacked by”), replaced content and unwanted changes are reported with before, after and highlighted differences; intended changes are accepted with one click. From the Agency plan, in the Website tab.

Subdomain inventory

DomainWarn now checks every known host name of your domain daily – from the website monitors, the zone at your DNS provider and the Certificate Transparency logs –, not just the domain and www: is the certificate valid and issued for this name, is HSTS set, does HTTP redirect to HTTPS? An expired or wrong certificate, such as the default certificate of a proxy, is reported as a warning, missing HSTS and a missing redirect as a hint. The table of all hosts is in the “Website” tab. Host names without a DNS record are left out, mail hosts are only checked for their certificate.

Single sign-on

On the Agency Pro plan your team signs in through your identity provider – Entra ID, Google Workspace, Okta, Keycloak, Authentik and any other with OpenID Connect. You prove your email domains with a DNS record, new members join the team on their first sign-in, and if you like, SSO becomes the only way in. A test sign-in shows what your provider sends before you switch it on. You find it under Settings › Organization › Single sign-on.

Mail test

Send a mail to a one-time address and see right away whether SPF, DKIM and DMARC pass, whether reverse DNS and encryption are right and whether the server is on a blacklist – with a score and recommendations. Free under Tools and per domain under Email › Mail test.

Compliance report for NIS2 and BSI TR-03108

From the Agency plan, DomainWarn shows per domain and per customer which requirements for secure email transport (BSI TR-03108), email authentication (BSI TR-03182) and the NIS2 measures are met – with evidence, recommendations and a PDF in your own design. Parked domains that send no email are checked too, so they cannot be used to spoof senders. A technical indication from the outside, not a certification.

Connect ChatGPT and Claude.ai with a click

DomainWarn can now be added as a connector in ChatGPT and Claude.ai without a token: enter the address https://api.domainwarn.com/mcp, sign in to DomainWarn, pick the organization and decide whether the assistant may make changes. Settings › API lists all connected apps, and you disconnect them with a click.

Tickets in HaloPSA, Autotask and ConnectWise PSA (Beta)

From the Agency plan, DomainWarn opens a ticket in your PSA system for every incident, at the client the domain belongs to. Escalations and reminders are added as internal notes, and once the incident is resolved the ticket is closed. You choose ticket fields such as board, status and priority per severity. The integrations are still in Beta.

NinjaOne (Beta)

From the Agency plan you connect DomainWarn to NinjaOne: incidents become tickets at your client’s organization, you import NinjaOne organizations as clients or create your clients there, and the state of all of a client’s domains appears as a table right in their organization. You switch on each part separately.

Record click paths with the mouse

Instead of writing selectors, you now click through an image of your page: DomainWarn outlines buttons, links and fields, a click turns one into a step, and after each step the browser replays the path. Checks for text and address are added the same way.

Dashboard as an app on your iPhone

Via Share › “Add to Home Screen” the dashboard becomes an app with its own icon and no browser bar – and push notifications now arrive on iPhone and iPad. Channels › Web Push explains how.

n8n

A dedicated trigger starts workflows on incidents, recoveries, changes and expiry warnings and sets up its webhook by itself; the DomainWarn node manages domains and incidents and runs the free checks.

Unused Free accounts are paused

If nobody signs in to a Free account for twelve months, monitoring pauses. We announce this by email 30 and 7 days in advance. The next sign-in resumes everything immediately; domains and history are kept. Paid plans are never paused.

Free plan: three domains for good for everyone who signs up in 2026

If you sign up by 31 December 2026, you keep three domains on Free for good – also after your trial or a subscription, nothing changes for you. Accounts created from 1 January 2027 monitor one domain on Free, otherwise with the same scope; further domains are paused, nothing is deleted.

Compliance report with Microsoft 365

If your mailboxes are on Microsoft 365, the compliance report now shows implicit TLS for mail clients only as a note: Microsoft 365 does not offer port 465, and this cannot be changed. For DNSSEC of the mail server zone, it lists the steps to switch it on in Microsoft 365.

Autoconfiguration with PACC

The mail autoconfiguration check now also knows PACC, the new way mail apps fetch their settings from ua-auto-config.<domain> (Stalwart suggests the record). If the name is set up, DomainWarn checks the certificate, TLS 1.3, the JSON file and its digest in DNS and warns when mail apps would discard the configuration – for example because the server only shows a default certificate. Without the record there is no alert.

Monthly report with a new design

The report for your clients now shows the key figures as tiles – availability against the SLA at a glance –, states and deadlines as coloured labels, readable dates and durations, incidents as cards and page numbers in the footer. The email that comes with it is redesigned too; your white-label applies as before.

Settings at full width

Settings and client pages now use the full width: fields sit side by side, and where there are several areas they appear in two columns – on a client’s status page, for example, the custom address sits to the right of the link and badge.

“Website” tab at a glance

Availability, protocol with compression, certificate, PageSpeed with the Core Web Vitals and the website check now sit right in the tab instead of behind further pages. Every tile of the website check leads to the affected pages.

Heartbeats with reliability and tolerance

Every heartbeat now shows the last 30 days with on-time, late and missed runs and the share of on-time runs – for WordPress and Shopware too. If you like, a heartbeat only alerts once several runs in a row have been missed.

Compression and caching of files

The website check now also tests your website’s stylesheets, scripts, fonts and images: whether they are delivered compressed and whether the browser may cache them. “What to do?” explains how to set this up at your host, in your web server, in your CDN or with a caching plugin.

Auto-renewal via IONOS too

For domains at IONOS, auto-renewal, transfer lock and expiry date now also come straight from the registrar – with the API key you have already added.

If MTA-STS runs on your own mail server, your BIMI record names your own logo or you maintain the security.txt yourself, Email and Website now show “Set up elsewhere” with what the check found – mode, mail servers, max age and ID, logo or contacts. Until now they said “Not set up” whenever DomainWarn itself served nothing. Switching to hosting by DomainWarn anyway asks you first.

Times in messages now appear as date and time in your organization’s time zone instead of a raw timestamp, and durations as “1 day and 10 hours” instead of “1.4 d” – in the dashboard, in notifications and in the tools.

When the HTTP/3 monitor confirms that your website speaks QUIC, the “Website” row now shows HTTP/3 instead of HTTP/2.

In the dark theme, coloured areas are readable again, such as the changes between two zone backups, the channel test result and hints in the DMARC assistant.

Buttons in our emails, such as “Open dashboard”, no longer show up as a light box with a dark bar in mail apps with a dark theme, but as one solid area in DomainWarn blue.

When a certificate authority renews a certificate that is still valid, “Certificate issuance” no longer reports it as unknown – for example Cloudflare, which renews its certificate at Google Trust Services every 60 days.

The subheadings under “More checks” on the “Website” tab have proper spacing above the first check again.

Checks no longer fail now and then: website checks and other requests occasionally came back empty two or three times a day and only ran again at the next interval.

“Certificate issuance” reports new certificates for your domains within minutes again; for very large certificate logs the delay was up to two hours at times.

Via MCP, domains and incidents now return the text of every finding; until now it was empty.

When a client’s status page runs under their own address or you have hidden “with DomainWarn” in your white-label, it no longer mentions DomainWarn – not at the bottom of the page, in the title, in the preview or in the favicon.

With white-label, the status page’s subscription form, confirmation, unsubscribe page and subscription emails also appear without DomainWarn. You set the link to your own privacy policy in white-label.

The DNS history now orders two states from the same second reliably. Until now, the current state, the list and the comparison with the previous state could pick the wrong one.

Compression of your website

The website check now shows whether your pages are delivered compressed – with Brotli, zstd or gzip – and reports it when they are not. “What to do?” explains how to switch compression on at your host, in your web server or in your CDN. The header tool and the domain check test it too.

Incidents in the client report

In the monthly report for your clients you can now choose per client what goes in: which sections and how much about each incident – timeline, who acknowledged it, cause and measures, before and after. You can hide single incidents, and a preview shows exactly the PDF your client receives.

Auto-renewal and transfer lock from the registrar

Through the INWX, OVHcloud and Route 53 integrations, DomainWarn now sees whether a domain renews automatically and whether the transfer lock is set. If a domain renews on its own, DomainWarn only warns when it has not been renewed a week before expiry – instead of a month ahead.

Extensions overview

Under Settings › Extensions you find every installation of the WordPress plugin and the Shopware extension with domain, version, last report and heartbeat state. A badge shows whether an installation reports regularly, is late or has been silent for more than a day; one click takes you to the domain’s inside view.

Status right inside WordPress and Shopware

In the new version of the WordPress plugin and the Shopware extension, the settings page shows whether the connection works, which addresses are monitored, the last report, the last error with its reason, the heartbeat and the next scheduled run. If WP-Cron is stuck, the matching cron job line is shown right there.

DomainWarn in Codex, ChatGPT, Claude and Zed

Under Settings › API there are now ready-made instructions to connect DomainWarn via MCP in Codex, ChatGPT, Claude.ai, Claude Desktop and Zed – in addition to Claude Code, Cursor and VS Code.

API examples to choose from

Under Settings › API you pick a language and a task and get the matching example with your address – for curl, PHP, JavaScript, Python, Go, PowerShell and more. For Prometheus, Grafana, Zabbix, Checkmk, Nagios, Uptime Kuma, PRTG and other monitoring systems there is a ready-made configuration. The same examples are in the docs.

Alerts delivered after an outage

If DomainWarn could not deliver an alert in time because of an outage on our side, it now arrives late with a note about the original time, as long as the incident is still open. Daily digests are sent afterwards.

Faster pages

The website and the dashboard load noticeably faster: pages and scripts are now compressed, the home page to about a seventh of its previous size.

Missed heartbeat with a cause

If the heartbeat of the WordPress plugin or the Shopware extension stops, DomainWarn names the likely cause – such as WP-Cron switched off without a cron job at the host, an unreachable website or a deactivated extension – and under “What to do?” the ready-made cron job line for your domain or the commands for Shopware.

Logos for systems, providers and channels

Wherever WordPress, Shopware, Nuxt, MariaDB, nginx, Cloudflare, Slack and the like appear, you now see their logo: on the CMS badge and in the CMS filter of the domain list, in the inside view, with the DNS integrations, the notification channels and the extensions. That way you find what you are looking for at a glance.

White-label from Agency

Reports in your own design and client emails through your own mail server are now included in the Agency plan, not only in Agency Pro.

Cron job instructions without a request from outside

If WP-Cron stalls, DomainWarn and the WordPress plugin now suggest a cron job that runs wp-cron.php directly with PHP on the server (or via WP-CLI) instead of calling the website over the network. The plugin shows the command with the right path and the matching PHP version, ready to copy.

Pure redirect domains no longer show a CMS. If a domain redirects to another one, it used to show the system of the target site; it now says “Redirects to …”.

The zone backup now reliably detects the latest snapshot even when two snapshots are taken in the same second, for example when restoring and backing up right after. Previously a run could compare against an older snapshot and report a change that was none.

When a website’s PageSpeed result changes, DomainWarn again confirms the change with a second measurement. Until now this confirmation stopped before Google had answered, and the change only showed up with the next regular measurement.

WooCommerce no longer shows up as a CMS of its own but as what it is: WordPress. Websites whose theme sets its own generator meta tag or ships WooCommerce styles (such as Divi) are no longer mistaken for shops. The cart-to-checkout journey template is still suggested when WooCommerce actually runs.

HTTP/3 monitoring

If a website advertises HTTP/3 via Alt-Svc, DomainWarn checks hourly (every 6 hours on Free) whether it also answers over QUIC. If UDP 443 is closed after a server move or firewall change, browsers wait and fall back to HTTP/2; the site feels slow although it is reachable. If HTTP/3 does not answer twice in a row, DomainWarn opens an incident. Switching HTTP/3 on or off shows up in the timeline. The monitor switches itself on as soon as the website offers HTTP/3; with HTTP/2 only it stays off, and you can switch it yourself in the settings at any time.

HTTP/3 check as a tool

The new free tool shows the Alt-Svc header per host and whether the website answers over QUIC. It is also part of the domain check, which now covers twenty checks; missing HTTP/3 costs no points there.

Change your email address

Under Profile › Email address, enter a new address together with your password. The change only takes effect once you click the link sent to the new address; until then your current address stays in use and you can discard the change. Afterwards your old address gets a notice, so a change never goes unnoticed. While the new address is unconfirmed, the dashboard points this out on every page; if you mistyped it, you can correct it right there.

HTTP/2 or HTTP/3 at a glance

A domain's overview now shows next to availability which protocol the website answers with, for example “HTTP/2 · HTTP/3 active”. If it advertises HTTP/3 but does not answer over QUIC, it says “HTTP/3 broken”. On the “Website” page each check shows its part.

Outdated PHP version in the inside view

If a WordPress or Shopware website runs a PHP version for which a newer patch release in the same branch exists, the inside view warns and explains what to do. Patch releases mainly fix security vulnerabilities. Before, DomainWarn only checked whether the PHP branch still receives security updates. No extension update is needed for this.

Account only after confirming the email address

After signing up, you continue once you have clicked the link in the confirmation email; before, DomainWarn could also be used with someone else's address. Until then you can request the email again or correct a mistyped address, and the link goes to the new one. If you come via an invitation, there is nothing to confirm – the invitation went to exactly that address.